§ 6-1-713.5 — Protection of personal identifying information - definition

Colorado § 6-1-713.5

• Jurisdiction: Colorado
• Title 06: Consumer
• Art.: Colorado Consumer Protection Act

Text

(1) To
protect personal identifying information, as defined in section 6-1-713 (2), from
unauthorized access, use, modification, disclosure, or destruction, a covered entity
that maintains, owns, or licenses personal identifying information of an individual
residing in the state shall implement and maintain reasonable security procedures
and practices that are appropriate to the nature of the personal identifying
information and the nature and size of the business and its operations.

(2) Unless a covered entity agrees to provide its own security protection for
the information it discloses to a third-party service provider, the covered entity
shall require that the third-party service provider implement and maintain
reasonable security procedures and practices that are:

(a) Appropriate to the nature of the personal identifying information
disclosed to the third-party service provider; and

(b) Reasonably designed to help protect the personal identifying information
from unauthorized access, use, modification, disclosure, or destruction.

(3) For the purposes of subsection (2) of this section, a disclosure of personal
identifying information does not include disclosure of information to a third party
under circumstances where the covered entity retains primary responsibility for
implementing and maintaining reasonable security procedures and practices
appropriate to the nature of the personal identifying information and the covered
entity implements and maintains technical controls that are reasonably designed
to:

(a) Help protect the personal identifying information from unauthorized
access, use, modification, disclosure, or destruction; or

(b) Effectively eliminate the third party's ability to access the personal
identifying information, notwithstanding the third party's physical possession of the
personal identifying information.

(4) A covered entity that is regulated by state or federal law and that
maintains procedures for protection of personal identifying information pursuant to
the laws, rules, regulations, guidances, or guidelines established by its state or
federal regulator is in compliance with this section.

(5) For the purposes of this section, third-party service provider means an
entity that has been contracted to maintain, store, or process personal identifying
information on behalf of a covered entity.

Legislative History

Source: L. 2018: Entire section added, (HB 18-1128), ch. 266, p. 1633, � 2, effective September 1.